$ show JingMatrix/TEESimulator
TEESimulator is a system-level Android root tool that intercepts and replaces hardware-backed key attestation for selected apps. It injects native libraries into the keystore daemon (keystore2 on Android 12+, keystore on 10/11) via ptrace, hooks Binder transactions, and routes KeyMint requests to an in-process Rust TA that implements AOSP's kmr-ta with BoringSSL. A Kotlin daemon runs as root, manages profiles (keybox, mode, device identity, patch levels), harvests real device parameters, and provides a WebUI for configuration. The system supports two modes: patch (re-sign real attestation leaf) and generation (mint keys entirely in software). It is designed for Android 10-17, requires root, and is distributed as a Magisk/KernelSU/APatch module. The architecture is a multi-process, multi-language system: a Kotlin control daemon (app_process), native C++ interceptors (keymint, keystore), a Rust TA (teesim-km), and a JavaScript WebUI. Communication between daemon and interceptors uses a custom JSON-based protocol over Unix domain sockets. The daemon harvests real device attestation parameters, resolves per-app profiles, and pushes configuration to the interceptors. The interceptors use PLT hooks (AIBinder_transact, ioctl) to redirect KeyMint/Keystore calls for target apps to the local TA, while forwarding non-target calls to the real hardware. The codebase demonstrates high craftsmanship in its handling of Android internals, with careful version branching, RAII wrappers for ptrace, safe file I/O via base64 heredoc, and a schema-driven WebUI. However, it is heavily dependent on Android API internals and may require updates with each major Android release. The project is actively maintained with recent commits and responsive issue triage.
The LLM identified 4 files worth highlighting for reuse:
A tiny, header-only JSON parser for C++ that is exception-free and recursion-limited. It provides a safe, minimal API for parsing JSON in resource-constrained environments (e.g., native Android code). Reusable in any C++ project that needs lightweight JSON parsing without external dependencies.
Implements a ptrace-based remote function call mechanism (remote_call) with RAII wrappers (PtraceAttachment, RegisterRestorer, RemoteLibraryHandle). Allows injecting and executing code in another process by attaching, transferring file descriptors, and calling dlopen/dlsym. The pattern is reusable for any system-level process manipulation on Linux/Android.
Provides atomic, injection-safe file writes by encoding content as base64 and using a heredoc pattern with `base64 -d > tmp && mv`. This prevents shell injection and ensures writes are atomic. Reusable in any web-based root manager UI that needs to write files via shell commands.
Implements a generic pattern to hook Binder ioctl calls on the server side, intercepting transactions for a specific service (IKeystoreService). It uses PLT hooks on libbinder.so to redirect ioctl and then dispatches based on transaction codes. The pattern is reusable for intercepting any Binder service on Android 10/11.